Privacy policy

Half Shell Studios provides the website and services you are reading about here. The data controller for personal data we describe on this page is the legal entity you contract or correspond with in your agreement or on invoices. If you are not yet a client and you only get in touch through this site, we still treat your details here as our responsibility. Contact: [email protected].

This policy applies to:

• this marketing website (including forms and email links you use to reach us), and
• general correspondence and enquiries before and during a possible project.

It does not replace a separate data processing agreement (DPA) or client contract we might sign for specific work, especially where we process data on your instructions as a processor. If you are a client, we can discuss documentation that fits the work.

When you browse the site

Like most sites, we may process technical information such as a truncated IP address, user agent, and basic server or security logs, so we can run the service, spot abuse, and fix issues. We do not run a third-party ad pixel on this marketing site by default.

When you use a form or email us

If you book a call, use a contact form, or email us, you might give us name, work email, phone number (if you choose), the message and context you add, and anything in your email headers and signature (for example company and role if you put them there).

If we work together

We may process client contact and project details so we can deliver work, invoice, agree access, and store reasonable records of what we were asked to do, subject to law and your contract.

We use personal data to:

• respond to your enquiry or booking;
• agree, deliver, and get paid for work you ask us to do;
• operate, secure, and improve the website and our email;
• comply with the law, account for tax and accounting, and defend our position in a dispute if we have to.

We do not use this marketing site to build profiles for unrelated automated decisions that affect you.

We rely on one or more of the following, depending on the situation:

• Legitimate interests — for example running a professional site, answering enquiries, light security analysis, and keeping a sensible record of B2B correspondence. We balance that against your rights.
• Contract — where you ask us to do work and we need the data to perform the agreement, or to prepare to sign one.
• Consent — where the law or the situation needs it, for example if we ever asked to send optional marketing beyond working together as agreed; you could withdraw that consent at any time.
• Legal obligation — where the law compels us to process or keep certain data (for example tax and accounting records in line with the rules that apply to us).

We keep information as long as needed for the reason we collected it, and no longer than is reasonable, including to meet legal, tax, and accounting requirements, resolve disputes, and make backups that may roll for a time. If you are unsure about a specific type of data, ask and we can explain the typical retention in context.

We use infrastructure and tools to host the site, send and receive email (in production, Mailgun or a similar transactional provider is typical for app mailers), and operate our app. Those providers are data processors when they handle personal data for us, under our instructions, and are bound by their terms and appropriate safeguards.

We do not list your data on the open market, and we do not sell it for ad targeting. If the law, lawful requests, or a court requires us to disclose something, we would do so when we believe we are required to.

Some of our service providers may host or process data in countries outside the UK (or outside the UK and EEA as applicable). Where we do that, we aim to rely on a permitted mechanism, such as adequacy decisions, Standard Contractual Clauses, or the IDTA-style arrangements that apply, depending on the provider and the year you read this. You can ask for a summary of the approach for the services we use at the time.

Under the UK GDPR (and the Data Protection Act 2018), you may have rights to access, correct, delete, restrict, object, or port your personal data in the situations the law provides. You may also have the right to lodge a complaint with a supervisory authority, such as the Information Commissioner’s Office (ICO) in the UK: https://www.ico.org.uk.

Contact us first if you want to exercise a right or have a question; we will respond in line with the law, though we may need to check who you are and balance your request with legal or contract duties that require us to keep some records (for example invoices and agreements for a time).

Optional analytics and advertising tags stay off until you choose Accept all or turn them on under Manage. Reject all stores that choice and loads neither. You can reopen the choice from Cookie settings in the footer. Last updated: October 2026.

Name	Who sets it	Why	When
halfshell_session (or the Laravel session cookie named in the app config)	Half Shell Studios	Keeps you signed in and protects forms. Strictly necessary.	Always, on pages that need a session
XSRF-TOKEN	Half Shell Studios	Stops cross-site form posts. Strictly necessary.	Always, on pages that need a session
Consent choice (hsx-consent in local storage, not a tracking cookie)	Half Shell Studios	Remembers Accept, Reject, or your Manage toggles.	After you choose
_ga, _ga_K8JY0HLEE5	Google Analytics (G-K8JY0HLEE5)	Counts visits.	Only after analytics consent
_gcl_au	Google Ads (AW-18409745642)	Measures ad clicks.	Only after marketing consent
test_cookie on doubleclick.net	Google Ads remarketing	Checks that the browser accepts ads cookies.	Only after marketing consent. We do not load the Ads tag before that.
Site Scout (sitescout.uk)	Half Shell Studios	Our own page analytics script.	Only after analytics consent. TODO: confirm whether the script is cookieless; until then it waits for the same consent as analytics.

We take reasonable technical and organisational steps to protect personal data against accidental loss or unauthorised access, change, or disclosure, including the usual steps you would expect for a small professional stack (access control, transport security where in our control, provider diligence). No method of transmission or storage is completely secure, but we do not want to be careless with your information.

Our services and site are aimed at businesses and adults acting in a professional capacity, not at children. We do not knowingly process children’s data through this site; if you believe a child has given us data in error, let us know and we will work with you in good faith to address it.

We may update this text when our practices, tools, or the law change. The last updated line at the top and this section will be revised when that happens. Continued use of the site after a material change, where the law does not need something stricter, can mean you have noted the new version, but for anything serious we can also add a short note on the site or in email where that makes sense.

• Email: [email protected]
• Data protection and general privacy questions — the same address is fine.
• Regulator (UK): Information Commissioner’s Office (ICO)

We would rather fix a problem with you than surprise anyone; if you are not happy, you can also complain to the ICO (see the link above).